A critical, actively exploited zero-day vulnerability in the FreePBX commercial Endpoint Manager module (CVE-2025-57819) allows unauthenticated remote code execution (RCE) and potentially root-level access on vulnerable systems, particularly those with public internet access to their admin panels.